fail2ban 0.9.2 on Debian

Asterisk Logger 設定

/etc/asterisk/logger.conf:

...
[logfiles]
...
fail2ban => notice,warning,security 

套用設定

#> asterisk -rx "logger reload"
#> asterisk -rx "logger show channels" 

設定 jail

for Asterisk)
/etc/fail2ban/jail.d/asterisk.conf

[asterisk]
enabled = true
logpath = /var/log/asterisk/fail2ban
maxretry = 5
bantime = 259200

for SSH)
/etc/fail2ban/jail.d/sshd.conf

[sshd]
enabled = true
logpath = %(sshd_log)s
bantime  = 1800

自動啟動

#> cd fail2ban-0.9.2/
#> cp files/debian-initd /etc/init.d/fail2ban
#> chmod 0755 /etc/init.d/fail2ban 
#> update-rc.d fail2ban defaults

以下 Call Log 無法被偵測到

Call from '' (195.154.134.116:5071) to extension '8011441295298642' rejected because extension not found in context 'public'.

Ans：設定 Asterisk 的 allowguest=no

編輯 sip.conf

allowguest=no

套用新設定

#> asterisk -rx "sip reload"
#> asterisk -rx "sip show settings" | grep -i "Allow unknown access"
  Allow unknown access:   No